idiom

pftriage

Python tool and library to help analyze files during malware triage and analysis.

OLEPackagerFormat

OLE Package Format Documentation

stackstack

activemime-format

ActiveMime File Format Documentation

capa

The FLARE team's open-source tool to identify capabilities in executable files.

EmerSearch

Search Emercoin NVS records

SiT

Simple Instruction Tracer

ABD

Course materials for Advanced Binary Deobfuscation by NTT Secure Platform Laboratories

binlex

A Binary Genetic Traits Lexer Framework

capa-rules

Standard collection of rules for capa: the tool for enumerating the capabilities of programs

capstone

Capstone disassembly/disassembler framework: Core (Arm, Arm64, BPF, EVM, M68K, M680X, MOS65xx, Mips, PPC, RISCV, Sparc, SystemZ, TMS320C64x, Web Assembly, X86, X86_64, XCore) + bindings.

gopep

Go Lang Portable Executable Parser

LIEF

LIEF - Library to Instrument Executable Formats

smda

SMDA is a minimalist recursive disassembler library that is optimized for accurate Control Flow Graph (CFG) recovery from memory dumps.

unicorn

Unicorn CPU emulator framework (ARM, AArch64, M68K, Mips, Sparc, X86)

vxsig

Automatically generate AV byte signatures from sets of similar binaries.

Yara-detection-rules

Yara Rules for Modern Malware

AlphaGolang

IDApython Scripts for Analyzing Golang Binaries

BINScripts

Collection of simple scripts for binary analysis and RE

CCCS-Yara

YARA rule metadata specification and validation utility / Spécification et validation pour les règles YARA

dotnetfile

idascope

An IDA Pro extension for easier (malware) reverse engineering

llvm-deobfuscator

qiling

Qiling Advanced Binary Emulation framework

speakeasy

Windows kernel and user mode emulation.

ursadb

Trigram database written in C++, suited for malware indexing

viv-utils

Utilities for working with vivisect

yara

The pattern matching swiss knife

Yara-Rules

Repository of Yara Rules

zydis

Fast and lightweight x86/x86-64 disassembler and code generation library